z3vok — Field noteshttps://z3vok.comSecurity notesPHP2Shell: I rebuilt PHP 8.3.35 and 8.3.36 to see what changed in two CVSS 9.2 RCEshttps://z3vok.com/writing/php2shell-cve-2026-109618-109619/https://z3vok.com/writing/php2shell-cve-2026-109618-109619/Wed, 21 Oct 2026 18:10:00 GMTTwo critical PHP runtime RCEs (CVE-2026-109618, CVE-2026-109619): root cause, the fix, and a defender-first remediation and detection guide, built from a from-source reproduction.The ARTEX Campaign: Evidence, Attribution, and Runtime Authorityhttps://z3vok.com/writing/artex-campaign-evidence-and-runtime-authority/https://z3vok.com/writing/artex-campaign-evidence-and-runtime-authority/Fri, 09 Oct 2026 16:00:00 GMTAn evidence-led analysis of the Korean finance disclosure: what agent artifacts can establish, what defenders should measure, and where runtime authority belongs.Security Boundaries, 2018–2026: What Changed and What Repeatedhttps://z3vok.com/writing/security-boundaries-2018-2026-retrospective/https://z3vok.com/writing/security-boundaries-2018-2026-retrospective/Thu, 24 Sep 2026 04:09:00 GMTA technical retrospective connecting speculative execution, identity, dependency trust and agent authorization through the boundaries each system assumes.An Authorized Security Assessment: From Scope to a Verified Fixhttps://z3vok.com/writing/authorized-assessment-evidence-to-retest/https://z3vok.com/writing/authorized-assessment-evidence-to-retest/Thu, 24 Sep 2026 04:08:00 GMTA complete assessment workflow using a synthetic document service: scope, trust boundaries, test controls, evidence, remediation and retesting.Active Directory Assessment Through Attack-Path Evidencehttps://z3vok.com/writing/active-directory-assessment-attack-path-evidence/https://z3vok.com/writing/active-directory-assessment-attack-path-evidence/Thu, 24 Sep 2026 04:00:00 GMTA read-only approach to assessing identity control paths, Kerberos evidence, delegation, and certificate enrollment without overstating what configuration proves.Agent Authorization Must Survive the Trip from Intent to Executionhttps://z3vok.com/writing/agent-runtime-authorization/https://z3vok.com/writing/agent-runtime-authorization/Thu, 24 Sep 2026 04:00:00 GMTA synthetic document-export workflow shows why task grants, resource-bound approvals, and execution-time state checks belong outside the model.Egress Validation: Proving Policy and Telemetry Agreehttps://z3vok.com/writing/egress-validation-policy-and-telemetry/https://z3vok.com/writing/egress-validation-policy-and-telemetry/Thu, 24 Sep 2026 04:00:00 GMTDesign bounded DNS and HTTPS canary tests that separate reachability, identity authorization, policy enforcement, and logging coverage.Evaluating Tenant Boundaries in an MCP and RAG Assistanthttps://z3vok.com/writing/evaluating-mcp-rag-tenant-boundaries/https://z3vok.com/writing/evaluating-mcp-rag-tenant-boundaries/Thu, 24 Sep 2026 04:00:00 GMTA proposed experiment separates retrieval isolation, tool consent, context provenance, and observed side effects instead of treating a refusal as proof of security.Persistence Investigation: Reconstructing What Survived and Whyhttps://z3vok.com/writing/persistence-investigation-forensic-reconstruction/https://z3vok.com/writing/persistence-investigation-forensic-reconstruction/Thu, 24 Sep 2026 04:00:00 GMTConnect Windows and Linux startup configuration to execution evidence, provenance, and a defensible recovery decision.From Source to Sink to Policy: A Practical Audit Workflow with Semgrep, CodeQL, and ZAPhttps://z3vok.com/writing/source-to-sink-auditing-semgrep-codeql-zap/https://z3vok.com/writing/source-to-sink-auditing-semgrep-codeql-zap/Thu, 24 Sep 2026 04:00:00 GMTA practical multi-language audit method that connects static data flow, authorization invariants, local HTTP evidence, and reproducible retesting.CVE-2026-22729: When a Vector Search Filter Becomes an Authorization Boundaryhttps://z3vok.com/writing/spring-ai-cve-2026-22729-filter-boundary/https://z3vok.com/writing/spring-ai-cve-2026-22729-filter-boundary/Thu, 24 Sep 2026 04:00:00 GMTA source review of Spring AI’s JSONPath filter injection, the converter patch, and a proposed validation plan for tenant isolation.Domain Fronting: Names, Layers and Visibilityhttps://z3vok.com/writing/Basic-Idea-and-Principle-of-Domain-Fronting/https://z3vok.com/writing/Basic-Idea-and-Principle-of-Domain-Fronting/Fri, 02 Apr 2021 02:38:00 GMTSeparating DNS names, TLS names and HTTP routing to explain what each network observer can see.Redis Access Control: Lab Notes and Hardeninghttps://z3vok.com/writing/Redis-Vulnerability-Exploitation-and-Security-Hardening/https://z3vok.com/writing/Redis-Vulnerability-Exploitation-and-Security-Hardening/Tue, 03 Nov 2020 15:25:00 GMTA historical local-lab study followed by network, command and service-account hardening considerations.FastJson Deserialization: From Property Assignment to Call Chainshttps://z3vok.com/writing/FastJson-Deserialization-Vulnerability/https://z3vok.com/writing/FastJson-Deserialization-Vulnerability/Mon, 03 Aug 2020 06:08:00 GMTFollowing type resolution, property setters and JNDI-related prerequisites in a historical lab.File Upload Security: Validation and Parser Differenceshttps://z3vok.com/writing/File-Upload-Vulnerabilities/https://z3vok.com/writing/File-Upload-Vulnerabilities/Thu, 16 Jul 2020 08:54:00 GMTExamining content checks, extensions, naming rules and multipart parsing across upload paths.Error-Based SQL Injection: Three Mechanisms Explainedhttps://z3vok.com/writing/3-Common-Error-SQL-Injection/https://z3vok.com/writing/3-Common-Error-SQL-Injection/Sun, 12 Jul 2020 09:30:00 GMTExamining overflow and XML errors, subquery aliases and version-dependent behavior.Auditing KKCMS: Following Input to Security-Sensitive Operationshttps://z3vok.com/writing/Code-Audit-KKCMS/https://z3vok.com/writing/Code-Audit-KKCMS/Tue, 07 Jul 2020 10:48:00 GMTTracing parameters through uploads, login and administrative forms to explain SQL injection, XSS and CSRF.SQL Injection Defenses and Filtering Boundarieshttps://z3vok.com/writing/Common-SQL-Injection-Defenses-and-Bypasses/https://z3vok.com/writing/Common-SQL-Injection-Defenses-and-Bypasses/Tue, 07 Jul 2020 06:28:00 GMTComparing escaping, type conversion, filtering and prepared statements through historical examples.CVE-2020-5902: F5 BIG-IP Analysis Noteshttps://z3vok.com/writing/CVE-2020-5902/https://z3vok.com/writing/CVE-2020-5902/Mon, 06 Jul 2020 05:38:00 GMTAn archived review of advisory details, validation paths, affected versions and mitigations.SQL Injection: Types, Syntax and Constraintshttps://z3vok.com/writing/Comprehensive-SQL-Injection-Summary/https://z3vok.com/writing/Comprehensive-SQL-Injection-Summary/Fri, 03 Jul 2020 07:10:00 GMTStudy notes on conversions, query structure, character sets, blind inference and database metadata.File Parsing and Server Configuration Boundarieshttps://z3vok.com/writing/File-Parsing-Vulnerabilities/https://z3vok.com/writing/File-Parsing-Vulnerabilities/Thu, 02 Jul 2020 10:54:00 GMTComparing historical Apache, PHP, FastCGI and IIS behavior at the boundary between uploaded data and execution.CBC Bit Flipping and Padding Oracleshttps://z3vok.com/writing/CBC-Byte-Flipping-Attack/https://z3vok.com/writing/CBC-Byte-Flipping-Attack/Mon, 29 Jun 2020 03:55:00 GMTWorking through XOR, intermediate values and the conditions behind two cryptographic attack patterns.5Space CTF 2020: Reading Web Exploit Chainshttps://z3vok.com/writing/2020-5Space-CTF-Web/https://z3vok.com/writing/2020-5Space-CTF-Web/Sun, 28 Jun 2020 12:24:00 GMTTracing parameters, encodings and magic methods through PHP, Java and Laravel challenges.SSRF and Gopher: Request Boundaries and Protocol Compositionhttps://z3vok.com/writing/SSRF-and-Gopher-Protocol/https://z3vok.com/writing/SSRF-and-Gopher-Protocol/Thu, 04 Jun 2020 01:16:00 GMTFollowing server-side requests through attributed practice cases and internal-service interactions.PHP Stream Wrappers and File Inclusionhttps://z3vok.com/writing/PHP-Protocols-and-File-Inclusion-Vulnerabilities/https://z3vok.com/writing/PHP-Protocols-and-File-Inclusion-Vulnerabilities/Sun, 24 May 2020 16:25:00 GMTComparing wrappers, filters and configuration-dependent behavior through local examples.XXE: XML, DTDs and Out-of-Band Validationhttps://z3vok.com/writing/From-Basics-to-Attack-XML-Entity-Injection/https://z3vok.com/writing/From-Basics-to-Attack-XML-Entity-Injection/Wed, 20 May 2020 10:05:00 GMTExplaining entity resolution, nested references and observable behavior in historical exercises.Hash Length Extension: Padding, State and Verificationhttps://z3vok.com/writing/Hash-Length-Extension-Attack/https://z3vok.com/writing/Hash-Length-Extension-Attack/Sun, 17 May 2020 14:23:00 GMTA walkthrough of padding, byte order and chaining state, with a PHP verification exercise.Wireshark: From Packet Capture to Protocol Analysishttps://z3vok.com/writing/From-Basics-to-Analysis-with-Wireshark/https://z3vok.com/writing/From-Basics-to-Analysis-with-Wireshark/Tue, 05 May 2020 11:47:00 GMTCapture placement, filters, conversation statistics and a closer reading of ARP, IP and TCP.XCTF Web: Source Code, State and Combined Weaknesseshttps://z3vok.com/writing/XCTF-WEB-Advanced/https://z3vok.com/writing/XCTF-WEB-Advanced/Wed, 12 Feb 2020 12:20:00 GMTChallenge notes on files, serialization, account state and uploads, with failed hypotheses and source attribution.Memory Forensics: Volatility and USB Keyboard Traceshttps://z3vok.com/writing/Memory-Forensics/https://z3vok.com/writing/Memory-Forensics/Fri, 10 Jan 2020 11:45:00 GMTHistorical notes on volatile evidence, process and network artifacts, and USB keyboard data.PHP Function Security: Comparison, Execution and Serializationhttps://z3vok.com/writing/PHP-Function-Vulnerabilities/https://z3vok.com/writing/PHP-Function-Vulnerabilities/Wed, 18 Dec 2019 12:20:00 GMTFollowing weak comparisons and input handling into execution and serialization behavior in older PHP environments.ISCC 2019 MISC: Encoding, Steganography and Reconstructionhttps://z3vok.com/writing/ISCC2019-MISC/https://z3vok.com/writing/ISCC2019-MISC/Tue, 14 May 2019 11:29:00 GMTFive challenge notes covering encodings, image fragments, keyboard traces and Python-assisted analysis.XSS Practice: Following Output Contexthttps://z3vok.com/writing/XSS-Wooyun-Practice/https://z3vok.com/writing/XSS-Wooyun-Practice/Thu, 14 Mar 2019 12:29:00 GMTTracing input into HTML, attributes and JavaScript through historical Wooyun training exercises.WPSEC 2019 Web: Source Analysis and Challenge Noteshttps://z3vok.com/writing/WPSEC-2019-Web/https://z3vok.com/writing/WPSEC-2019-Web/Mon, 04 Mar 2019 10:45:00 GMTWorking through variable handling, comparisons, regular expressions and uploads, including an unfinished investigation.SQL Injection: Response Signals and Query Contexthttps://z3vok.com/writing/SQL-Injection-Types/https://z3vok.com/writing/SQL-Injection-Types/Tue, 22 Jan 2019 11:59:00 GMTComparing response channels and explaining how input changes numeric, string and search queries.SQLi-Labs 21–40: Filtering, Encoding and Second-Order Injectionhttps://z3vok.com/writing/sql-lab(21-40)/https://z3vok.com/writing/sql-lab(21-40)/Sun, 20 Jan 2019 12:05:00 GMTHistorical exercises on cookies, comment filters, character sets and changing input contexts.